rldyour macOS and Ubuntu bootstrap

Plan-first bootstrap for Apple Silicon macOS, Ubuntu 24.04/26.04 desktops, headless Ubuntu servers, and an Ubuntu 24.04 amd64 remote desktop server. The current contract is 0.2.2.

Profiles

Target	GUI	Docker	Policy
macOS desktop	optional	none	source analysis and local checks
Ubuntu desktop	optional	none	source analysis and local checks
Ubuntu desktop-builds	optional	rootful	local builds and tests
Ubuntu 24.04 desktop-server	required	none by default	interactive remote workstation
Ubuntu server	none	rootful by default	production server/container host

Every profile receives the zsh-first terminal environment, source-analysis tools, language servers, Codex CLI, Claude Code, Grok Build, and the launchers cx, cl, and gk. The interactive terminal tools the shell template binds aliases to are the same set on both platforms — config/rldyour-contract.json declares them under terminal_tools.shared, and a test fails if either installer stops publishing one. Four macOS tools are deliberately outside that set (duckdb, jnv, xh, yazi); the contract records why for each. These launchers select each vendor's explicit unrestricted mode; use them only on machines and repositories you trust.

GUI workstations install Google Chrome stable. macOS GUI additionally installs Ghostty, cmux, ChatGPT, Claude, RustDesk, and Telegram. Ubuntu GUI installs Chrome, RustDesk, Telegram, desktop integration, and removes Firefox. Headless profiles do not install GUI applications. Herdr is installed and verified on macOS and every Ubuntu profile, including headless desktops and servers. Ubuntu GUI is supported on amd64; ARM64 remains supported with --no-gui because Google and Telegram publish no compatible Linux ARM64 applications.

Desktop source hosts include Node, Python, LLVM/clangd, Go/gopls, Rust with rust-analyzer, Dart with its analysis server, Kotlin, TypeScript, Svelte, SQL, YAML, Bash, Dockerfile, HTML/CSS/JSON, TOML, Markdown, Terraform, CMake, GitHub Actions, and Ansible analysis tooling. Swift/SwiftUI analysis remains on the macOS source hosts where the Apple SDK and SourceKit toolchain exist. The desktop profile does not authorize project execution or deployment. Use desktop-builds for local Docker builds/tests.

The Ubuntu server profile installs and verifies a server baseline, Docker, unattended security updates, and time synchronization. UFW, key-only SSH, and Fail2ban remain independent explicit opt-ins to prevent accidental lockout.

desktop-server composes the GUI workstation and full server baseline while leaving Docker disabled unless explicitly selected. XRDP listens only on 127.0.0.1:3389; clients reach it through an owner-managed OpenSSH local forward. The deployment-time client renderer emits credential-free macOS and Windows installers, pins the server's Ed25519 host key, tries SSH ports 22 and 443, and creates normal and slow-network RDP profiles. See the desktop-server reference.

Usage

# Plans (default)
bash scripts/bootstrap.sh --platform macos
bash scripts/bootstrap.sh --platform macos --no-gui
bash scripts/bootstrap.sh --platform ubuntu --profile desktop
bash scripts/bootstrap.sh --platform ubuntu --profile desktop-builds
bash scripts/bootstrap.sh --platform ubuntu --profile desktop-server
bash scripts/bootstrap.sh --platform ubuntu --profile server

# Apply
bash scripts/bootstrap.sh --platform macos --apply
bash scripts/bootstrap.sh --platform ubuntu --profile desktop --apply
bash scripts/bootstrap.sh --platform ubuntu --profile desktop-builds --apply
bash scripts/bootstrap.sh --platform ubuntu --profile desktop-server --apply
bash scripts/bootstrap.sh --platform ubuntu --profile server --apply

Supported recovery skips are --skip-system, --skip-ai, --skip-lsps, and --skip-checks. Authentication is always an owner handoff:

bash scripts/auth-handoff.sh show
bash scripts/auth-handoff.sh check

Validation

bash scripts/ci/setup-test-env.sh
bash scripts/ci/lint.sh
bash scripts/ci/validate.sh
.venv/bin/python -m pytest

setup-test-env.sh establishes what the suite needs — a real zsh, and the hash-locked Python 3.14 environment — and is idempotent. python3 -m pytest passes only where pytest already happened to be installed, and the terminal-portability suite asserts against a real zsh rather than skipping without one.

Real platform behavior must also be verified on the corresponding macOS or Ubuntu host; container checks are not evidence for launchd, systemd, GNOME, SSH, firewall, Docker daemon, or macOS application behavior.

The machine-readable support and proof boundary is config/support-evidence-matrix.json. It distinguishes required core behavior from optional real-host capabilities and prevents hosted or container evidence from being promoted to a stronger tier. A successful evidence lane may contain typed NOT_PROVEN observations only for optional capabilities; every required capability must be PROVEN. See the support/evidence reference for the typed tiers, current hosted coverage, and explicit real-host gaps.

CI feedback

Ordinary CI reports evidence and failures without blocking merge or deployment. Pull requests, signed commits, deletion protection and non-fast-forward protection remain required. Release publication separately requires the exact candidate checks, matching source tree, and verified platform-evidence verdict.

The CI feedback workflow reports unsuccessful completed self-workflow attempts as unassigned issues in this repository. It uses a pinned publisher and records actual job conclusions and attempt identity without executing source-run code. Issue publication does not launch a repair agent or authorize deployment.

Unreleased reusable workflows use commit:<full SHA> as their registered version and inline pin comment. The validator requires that identity to equal the pinned commit; it does not label development source as a stable release.